Make current -strict behaviour default

[cpu]

Pebble is carrying some breaking changes that more closely reflect the ACME specification but could break clients. To make Pebble less annoying to use in CI we gate these changes behind the -strict feature flag so that clients can make a choice about whether they'd like a stable(ish) ACME server for CI, or to find compatibility problems in their client before they become an issue with Let's Encrypt's production servers.

At some point in the near future we should make a flag day to convert the -strict behaviours to default. Most of them have been present for some time and I think its reasonable to switch them to default soon.

At present these are the -strict changes that would become default:

• GET requests to Order, Authz, Challenge and Certificate resources will fail. POST-as-GET will be required.
• HEAD requests to new nonce will return status 200 not status 204.
• POST requests will be required to have the correct Content-Type header: application/jose+json
• Using a POST with an empty JWS body to fetch Account resources will fail. A POST-AS-GET request should be used instead.
• POSTs to Challenge resources that contain a key authorization in the JWS body will fail. The JWS body should be the trivial JSON payload {}.
• TLS-ALPN-01 challenge response certificates using the obsolete OID (1.3.6.1.5.5.7.1.30.1) will fail validation. The current OID should (1.3.6.1.5.5.7.1.31) be used.

[cpu]

I think if we switch to semver (#146) this would be a natural point at which to bump major version numbers.

[jsha]

Let's go ahead and choose this flag day as February 15. We'll merge a PR to master making these behaviors the default, and bump to v2.0.0. Please post here if you expect this to cause big problems for you.

[Klaus-Tockloth]

The current Certbot release (0.30.2) isn't working (for me) in strict mode (option -strict):

{
   "type": "urn:ietf:params:acme:error:malformed",
   "detail": "Challenge response body contained legacy KeyAuthorization field, POST body should be `{}`",
   "status": 400
}

[jsha]

Thanks for checking! I've told the Certbot team

[cpu]

Let's go ahead and choose this flag day as February 15. We'll merge a PR to master making these behaviors the default, and bump to v2.0.0.

We're running slightly behind schedule on this and are going to delay the v2.0.0 release to next week (likely Feb 19th).

[cpu]

Master now defaults to enforcing all of the behaviours previously gated by -strict 🎉 👨‍🏫

Later today after #207 is merged I will cut the release tag for 2.0.0.

[cpu]

Release 2.0.0 and updated docker images are both now available. Thanks everyone!